Mar 22 · Sat 5:39 PM PDT
First commit. ff48ab39a Milestone
"first commit." An Express server, a package.json, and a hope. The repository starts.
61-Day Timeline
From git init to today, in order.
Every entry below corresponds to a real commit, a real infrastructure event, or a real incident. The dates aren't rounded. If you want the narrative version, read Our Story. This page is for skimmers.
Phase 1 — The basics work
Mar 23 · Sun 5:18 AM
Secure HLS streaming end-to-end. 5c5b3463a
RS256-signed JWT tokens injected into HLS playlist segment URLs. The first video frame ever served by TinyGuard was secure by construction — no hot-link-able URLs, no exposed camera credentials, no IP whitelisting drama.
Mar 23 · Sun 3:36 PM
Sprint 14: push cameras + Caddyfile. 8372fd4ba
By the end of day two, the system accepted push-based camera registration and ran behind Caddy. The push-camera path is what eventually became the device-setup one-line installer.
Late Mar · Week 2
All six Sunshine cameras live. Milestone
The six cameras in Laura's daycare came online in MediaMTX, paths prefixed with the tenant ID. Laura could see her own classrooms on a phone for the first time without going to a closet.
Apr · early
Care log, parent portal, tuition billing.
Care entries with photo capture; parent-facing portal with tokenized clip-sharing; first version of Stripe-based tuition billing. The "six tools Laura was juggling" problem starts collapsing into one screen.
Phase 2 — Things that went wrong
Apr 24 · D170 incident
Neon free tier blew up in 8 days. Outage
The 5 GB/mo data-transfer cap on Neon's free tier capped HTTP 402 on every database query. Whole API went down. Upgraded to the Launch plan ($19/mo, 50 GB cap) within the hour. Followup discipline: no agent runs pg_dump or full-table reads against prod outside the backup workflow.
May 1–17 · staging burn
Staging Neon branch ate 30+ GB egress. Outage
The Neon staging branch — used by api-vitest CI shards — quietly consumed 30+ GB of data transfer in the first half of May, pushing us over the 50 GB Launch cap. C601 deleted the staging branch on May 18 after Larry C542 moved api-vitest to per-job postgres containers. Forward velocity now projects ~19 GB/mo with comfortable headroom.
~ · early infra
Transcoder ran hot until it discolored. Hardware
The Ryzen test rig in Del's office pinned a CPU core at 100% for three days during a libsvtav1 calibration sweep. Heatsink discolored. Fans had been at supersonic the whole time. We tuned the encoder preset, replaced the heatsink paste, and added a CPU watchdog daemon (tinyguard-cpu-watchdog.sh) that demotes cameras to H.264 passthrough under sustained load.
Phase 3 — Things that went right
Apr 16
WireGuard retired. CF Tunnel takes over. Cutover
The Pi originally reached the API through a WireGuard VPN running on EC2. Cloudflare Tunnel does the same job with zero servers, zero attack surface, and zero dollars. We cut the Pi over and shut WireGuard down. (We miss WireGuard. It was a good piece of software. We don't miss running it.)
Apr 23
Phase 4 RLS live. Security
Row-Level Security forced on 398 facility-scoped tables. Application code touches the database through the app role, which is subject to tenant_isolation policies — a stray WHERE clause cannot leak across tenants. Cross-tenant reads go through an explicit BYPASSRLS admin role used only by auth / device / super-admin paths.
May ~
AV1 hybrid pipeline lands. Performance
Cameras pump native H.264. MediaMTX takes the feed once. Live goes out as H.264 passthrough through Cloudflare Calls' WebRTC SFU — Pi sees one viewer per camera no matter how many parents watch. Record forks off and AV1-encodes per camera (av1_nvenc on the Ryzen rig, libsvtav1 preset 13 on the Pi) and segments to R2 every hour. ~1/3 the storage of H.264 for the same quality.
May 5 · S185
EC2 (prod) terminated. Cutover
The production API moved fully to Cloudflare Workers. The prod EC2 instance — which had been running Hono on Bun behind ALB — was terminated. AMI retained for 30 days as a panic-button revert. We never pressed it.
May 7 · S185 phase 2
EC2 (staging) terminated. Cutover
The staging EC2 instance was used as a self-hosted GitHub Actions builder. RunsOn ephemeral runners (and later philips-labs JIT runners on demand) replaced it. The instance was terminated. AMI retained 30 days, then deleted (S278). All retained AMIs gone by May 15.
May 17 · C581
Staging environment fully retired. 1f8f9ebda
The CF Worker + Pages staging project, the staging DNS, the staging Git branch, the staging workflow, and the staging block in wrangler.toml all removed in one commit per Del's directive. Main now ships direct to prod. CI runs against per-job Postgres containers instead of a shared staging branch.
May 19
12-agent coordination Durable Object lands. Milestone
The 12 dev agents (Billy, Frank, Tim, Sam, Doug, Chris, Larry, Bob, Magenta, Luther, Al, Maya) move off git-only coordination onto a Cloudflare Durable Object with native SSE fanout. Sprint-number allocation becomes atomic. Cross-machine claim latency drops from multi-minute git-pull/push lag to sub-second.
Phase 4 — Today
May 22 · today
61 days in. Snapshot
2,325 API routes across 1,762 unique paths. 91+ database tables. 1,225 regression sentinel files containing 35,537 individual assertions. 12 specialized AI dev agents. 6 cameras in our living room, still. Sunshine Day Care has stopped using five of its six legacy tools.
0 paying customers. By design. Five founding-partner spots open. Price locked for as long as you're a founding partner. Pi 5 hardware $299 one-time. Cancel anytime.
If something on this page reads like spin, the commit SHA is right there. Look it up. The git log is public.
If you want the part of the story that doesn't have a commit attached — Laura, the daycare, the parent who asked for the footage — read Our Story.